2 * cn_proc.c - process events connector
4 * Copyright (C) Matt Helsley, IBM Corp. 2005
5 * Based on cn_fork.c by Guillaume Thouvenin <guillaume.thouvenin@bull.net>
6 * Original copyright notice follows:
7 * Copyright (C) 2005 BULL SA.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25 #include <linux/module.h>
26 #include <linux/kernel.h>
27 #include <linux/ktime.h>
28 #include <linux/init.h>
29 #include <linux/connector.h>
30 #include <linux/gfp.h>
31 #include <linux/ptrace.h>
32 #include <linux/atomic.h>
33 #include <linux/pid_namespace.h>
35 #include <linux/cn_proc.h>
38 * Size of a cn_msg followed by a proc_event structure. Since the
39 * sizeof struct cn_msg is a multiple of 4 bytes, but not 8 bytes, we
40 * add one 4-byte word to the size here, and then start the actual
41 * cn_msg structure 4 bytes into the stack buffer. The result is that
42 * the immediately following proc_event structure is aligned to 8 bytes.
44 #define CN_PROC_MSG_SIZE (sizeof(struct cn_msg) + sizeof(struct proc_event) + 4)
46 /* See comment above; we test our assumption about sizeof struct cn_msg here. */
47 static inline struct cn_msg
*buffer_to_cn_msg(__u8
*buffer
)
49 BUILD_BUG_ON(sizeof(struct cn_msg
) != 20);
50 return (struct cn_msg
*)(buffer
+ 4);
53 static atomic_t proc_event_num_listeners
= ATOMIC_INIT(0);
54 static struct cb_id cn_proc_event_id
= { CN_IDX_PROC
, CN_VAL_PROC
};
56 /* proc_event_counts is used as the sequence number of the netlink message */
57 static DEFINE_PER_CPU(__u32
, proc_event_counts
) = { 0 };
59 static inline void send_msg(struct cn_msg
*msg
)
63 msg
->seq
= __this_cpu_inc_return(proc_event_counts
) - 1;
64 ((struct proc_event
*)msg
->data
)->cpu
= smp_processor_id();
67 * Preemption remains disabled during send to ensure the messages are
68 * ordered according to their sequence numbers.
70 * If cn_netlink_send() fails, the data is not sent.
72 cn_netlink_send(msg
, 0, CN_IDX_PROC
, GFP_NOWAIT
);
77 void proc_fork_connector(struct task_struct
*task
)
80 struct proc_event
*ev
;
81 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
82 struct task_struct
*parent
;
84 if (atomic_read(&proc_event_num_listeners
) < 1)
87 msg
= buffer_to_cn_msg(buffer
);
88 ev
= (struct proc_event
*)msg
->data
;
89 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
90 ev
->timestamp_ns
= ktime_get_ns();
91 ev
->what
= PROC_EVENT_FORK
;
93 parent
= rcu_dereference(task
->real_parent
);
94 ev
->event_data
.fork
.parent_pid
= parent
->pid
;
95 ev
->event_data
.fork
.parent_tgid
= parent
->tgid
;
97 ev
->event_data
.fork
.child_pid
= task
->pid
;
98 ev
->event_data
.fork
.child_tgid
= task
->tgid
;
100 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
101 msg
->ack
= 0; /* not used */
102 msg
->len
= sizeof(*ev
);
103 msg
->flags
= 0; /* not used */
107 void proc_exec_connector(struct task_struct
*task
)
110 struct proc_event
*ev
;
111 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
113 if (atomic_read(&proc_event_num_listeners
) < 1)
116 msg
= buffer_to_cn_msg(buffer
);
117 ev
= (struct proc_event
*)msg
->data
;
118 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
119 ev
->timestamp_ns
= ktime_get_ns();
120 ev
->what
= PROC_EVENT_EXEC
;
121 ev
->event_data
.exec
.process_pid
= task
->pid
;
122 ev
->event_data
.exec
.process_tgid
= task
->tgid
;
124 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
125 msg
->ack
= 0; /* not used */
126 msg
->len
= sizeof(*ev
);
127 msg
->flags
= 0; /* not used */
131 void proc_id_connector(struct task_struct
*task
, int which_id
)
134 struct proc_event
*ev
;
135 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
136 const struct cred
*cred
;
138 if (atomic_read(&proc_event_num_listeners
) < 1)
141 msg
= buffer_to_cn_msg(buffer
);
142 ev
= (struct proc_event
*)msg
->data
;
143 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
145 ev
->event_data
.id
.process_pid
= task
->pid
;
146 ev
->event_data
.id
.process_tgid
= task
->tgid
;
148 cred
= __task_cred(task
);
149 if (which_id
== PROC_EVENT_UID
) {
150 ev
->event_data
.id
.r
.ruid
= from_kuid_munged(&init_user_ns
, cred
->uid
);
151 ev
->event_data
.id
.e
.euid
= from_kuid_munged(&init_user_ns
, cred
->euid
);
152 } else if (which_id
== PROC_EVENT_GID
) {
153 ev
->event_data
.id
.r
.rgid
= from_kgid_munged(&init_user_ns
, cred
->gid
);
154 ev
->event_data
.id
.e
.egid
= from_kgid_munged(&init_user_ns
, cred
->egid
);
160 ev
->timestamp_ns
= ktime_get_ns();
162 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
163 msg
->ack
= 0; /* not used */
164 msg
->len
= sizeof(*ev
);
165 msg
->flags
= 0; /* not used */
169 void proc_sid_connector(struct task_struct
*task
)
172 struct proc_event
*ev
;
173 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
175 if (atomic_read(&proc_event_num_listeners
) < 1)
178 msg
= buffer_to_cn_msg(buffer
);
179 ev
= (struct proc_event
*)msg
->data
;
180 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
181 ev
->timestamp_ns
= ktime_get_ns();
182 ev
->what
= PROC_EVENT_SID
;
183 ev
->event_data
.sid
.process_pid
= task
->pid
;
184 ev
->event_data
.sid
.process_tgid
= task
->tgid
;
186 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
187 msg
->ack
= 0; /* not used */
188 msg
->len
= sizeof(*ev
);
189 msg
->flags
= 0; /* not used */
193 void proc_ptrace_connector(struct task_struct
*task
, int ptrace_id
)
196 struct proc_event
*ev
;
197 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
199 if (atomic_read(&proc_event_num_listeners
) < 1)
202 msg
= buffer_to_cn_msg(buffer
);
203 ev
= (struct proc_event
*)msg
->data
;
204 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
205 ev
->timestamp_ns
= ktime_get_ns();
206 ev
->what
= PROC_EVENT_PTRACE
;
207 ev
->event_data
.ptrace
.process_pid
= task
->pid
;
208 ev
->event_data
.ptrace
.process_tgid
= task
->tgid
;
209 if (ptrace_id
== PTRACE_ATTACH
) {
210 ev
->event_data
.ptrace
.tracer_pid
= current
->pid
;
211 ev
->event_data
.ptrace
.tracer_tgid
= current
->tgid
;
212 } else if (ptrace_id
== PTRACE_DETACH
) {
213 ev
->event_data
.ptrace
.tracer_pid
= 0;
214 ev
->event_data
.ptrace
.tracer_tgid
= 0;
218 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
219 msg
->ack
= 0; /* not used */
220 msg
->len
= sizeof(*ev
);
221 msg
->flags
= 0; /* not used */
225 void proc_comm_connector(struct task_struct
*task
)
228 struct proc_event
*ev
;
229 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
231 if (atomic_read(&proc_event_num_listeners
) < 1)
234 msg
= buffer_to_cn_msg(buffer
);
235 ev
= (struct proc_event
*)msg
->data
;
236 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
237 ev
->timestamp_ns
= ktime_get_ns();
238 ev
->what
= PROC_EVENT_COMM
;
239 ev
->event_data
.comm
.process_pid
= task
->pid
;
240 ev
->event_data
.comm
.process_tgid
= task
->tgid
;
241 get_task_comm(ev
->event_data
.comm
.comm
, task
);
243 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
244 msg
->ack
= 0; /* not used */
245 msg
->len
= sizeof(*ev
);
246 msg
->flags
= 0; /* not used */
250 void proc_coredump_connector(struct task_struct
*task
)
253 struct proc_event
*ev
;
254 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
256 if (atomic_read(&proc_event_num_listeners
) < 1)
259 msg
= buffer_to_cn_msg(buffer
);
260 ev
= (struct proc_event
*)msg
->data
;
261 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
262 ev
->timestamp_ns
= ktime_get_ns();
263 ev
->what
= PROC_EVENT_COREDUMP
;
264 ev
->event_data
.coredump
.process_pid
= task
->pid
;
265 ev
->event_data
.coredump
.process_tgid
= task
->tgid
;
267 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
268 msg
->ack
= 0; /* not used */
269 msg
->len
= sizeof(*ev
);
270 msg
->flags
= 0; /* not used */
274 void proc_exit_connector(struct task_struct
*task
)
277 struct proc_event
*ev
;
278 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
280 if (atomic_read(&proc_event_num_listeners
) < 1)
283 msg
= buffer_to_cn_msg(buffer
);
284 ev
= (struct proc_event
*)msg
->data
;
285 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
286 ev
->timestamp_ns
= ktime_get_ns();
287 ev
->what
= PROC_EVENT_EXIT
;
288 ev
->event_data
.exit
.process_pid
= task
->pid
;
289 ev
->event_data
.exit
.process_tgid
= task
->tgid
;
290 ev
->event_data
.exit
.exit_code
= task
->exit_code
;
291 ev
->event_data
.exit
.exit_signal
= task
->exit_signal
;
293 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
294 msg
->ack
= 0; /* not used */
295 msg
->len
= sizeof(*ev
);
296 msg
->flags
= 0; /* not used */
301 * Send an acknowledgement message to userspace
303 * Use 0 for success, EFOO otherwise.
304 * Note: this is the negative of conventional kernel error
305 * values because it's not being returned via syscall return
308 static void cn_proc_ack(int err
, int rcvd_seq
, int rcvd_ack
)
311 struct proc_event
*ev
;
312 __u8 buffer
[CN_PROC_MSG_SIZE
] __aligned(8);
314 if (atomic_read(&proc_event_num_listeners
) < 1)
317 msg
= buffer_to_cn_msg(buffer
);
318 ev
= (struct proc_event
*)msg
->data
;
319 memset(&ev
->event_data
, 0, sizeof(ev
->event_data
));
321 ev
->timestamp_ns
= ktime_get_ns();
323 ev
->what
= PROC_EVENT_NONE
;
324 ev
->event_data
.ack
.err
= err
;
325 memcpy(&msg
->id
, &cn_proc_event_id
, sizeof(msg
->id
));
326 msg
->ack
= rcvd_ack
+ 1;
327 msg
->len
= sizeof(*ev
);
328 msg
->flags
= 0; /* not used */
334 * @data: message sent from userspace via the connector
336 static void cn_proc_mcast_ctl(struct cn_msg
*msg
,
337 struct netlink_skb_parms
*nsp
)
339 enum proc_cn_mcast_op
*mc_op
= NULL
;
342 if (msg
->len
!= sizeof(*mc_op
))
346 * Events are reported with respect to the initial pid
347 * and user namespaces so ignore requestors from
350 if ((current_user_ns() != &init_user_ns
) ||
351 (task_active_pid_ns(current
) != &init_pid_ns
))
354 /* Can only change if privileged. */
355 if (!__netlink_ns_capable(nsp
, &init_user_ns
, CAP_NET_ADMIN
)) {
360 mc_op
= (enum proc_cn_mcast_op
*)msg
->data
;
362 case PROC_CN_MCAST_LISTEN
:
363 atomic_inc(&proc_event_num_listeners
);
365 case PROC_CN_MCAST_IGNORE
:
366 atomic_dec(&proc_event_num_listeners
);
374 cn_proc_ack(err
, msg
->seq
, msg
->ack
);
378 * cn_proc_init - initialization entry point
380 * Adds the connector callback to the connector driver.
382 static int __init
cn_proc_init(void)
384 int err
= cn_add_callback(&cn_proc_event_id
,
388 pr_warn("cn_proc failed to register\n");
394 module_init(cn_proc_init
);